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We have recently examined, for possible application to digital 
mobile radio telephony, a digital spread- spectrum technique employ- 
ing multiple frequency- shift keying (mfsk) modulation with code- 
division-multiple access (cdma) by frequency -hopping over a common 
bandwidth. The system uses the cellular approach where all mobiles 
within a cell communicate with a fixed base station in the cell. An 
analysis of base-to-mobile transmission shows that mutual interfer- 
ence limits the number of users which the system can accommodate 
at a given error rate. This paper describes a new decoding scheme to 
reduce mutual interference which makes use of the well-defined 
algebraic structure of the users' addresses. Analysis of the new 
decoder at high signal to noise (s/n) ratio shows it to outperform 
conventional decoding, allowing a 50 to 60 percent increase in the 
number of users who can simultaneously share the system at a given 
error rate. We describe a simple implementation of the decoder using 
shift registers. 

I. INTRODUCTION 

We have examined a digital spread-spectrum modulation technique 
employing frequency-hopping and multiple frequency-shift keying 
(mfsk) for multiple-access satellite communication 1 and for digital 
mobile radio telephony. 2 Every T seconds each user conveys a K-bit 
message by transmitting a sequence of L tones chosen from an alphabet 
of 2 K sine waves of duration t(= T/L). Code-division multiplexing is 
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used, and the message is modulated onto the address (code) assigned 
to each user. 

The receiver, knowing the address, can decode the received signal 
and extract the message. However, transmissions by other users can 
combine to cause an erroneous message, resulting in an ambiguous 
reception. Thus even without channel impairments, the number of 
simultaneous users the system can support at a given error probability 
is interference limited. 

The interference can be minimized by a proper choice of addresses 
with minimum cross correlation. Schemes for assigning 2 K addresses 
which guarantee minimum mutual interference between 2 K or fewer 
users have been proposed. 3 

The performance of the system could be improved, in principle, by 
decoding the addresses of all possible users and analyzing the interfer- 
ence pattern. Such a complete decoding scheme is very complex. 

This paper describes a simpler decoder which makes use of the well- 
defined algebraic structure of the sequences 3 to eliminate erroneous 
messages which come from interference. The result is a significant 
improvement in the performance of the system with a much smaller 
complexity than complete decoding. If, for example, the system has a 
total one-way bandwidth of 20 MHz and the data rate of each user is 
32 kilobit/second, the number of users which the system can support 
at a bit error probability of 10~ 3 is increased by 60 percent over that 
attainable with conventional decoding. 

In the performance analysis of the new decoder, an ideal (error-free) 
channel has been assumed. The conventional scheme has been further 
analyzed 2 for base-to-mobile transmission through noisy and multipath 
fading channels and was found to degrade gracefully. Under the same 
conditions, the new decoder is expected to have a similar degradation 
attaining its substantial improvements over the conventional decoder. 

II. SYSTEM DESCRIPTION 

The elementary signals of the system are a set of 2 K sine waves 
which are orthogonal over the chip duration t. Every T seconds each 
user conveys a K-bit message by transmitting a sequence of L tones of 
duration r chosen from the signal set. The sequence is uniquely 
determined by the user's address and the K-bit message and can be 
described as a pattern in the L X 2 K time-frequency matrix A. Simul- 
taneous transmissions by M users can result in up to L X M entries in 
A (Fig. 1). 

Let the address of the mth user be denoted by a vector a m : 

a m = (ami, Om2, " ' • > CtmL), 

where each a m i is a K-bit number corresponding to one of the 2 K 
frequencies of the system. 
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The transmitted sequence Y m is formed by modulating the message 
X m onto a m . The message can modulate the address in different ways. 
In Refs. 1 and 2, this is done by summing (mod 2 K ) the address and 
the message to obtain 



where 



I m — Hm ' -Am* A) 



1-U.l, •••,!)• 



(1) 



Other schemes are possible (see, for example, Ref. 3) as long as Y m can 
be uniquely decoded. 

Every t seconds the receiver performs a spectral analysis of the 
composite received signal Y and decides which of the 2 K frequency 
cells contain energy. Thus after T seconds, assuming no channel 
impairments, a duplicate of A is generated at the receiver. 

To decode X m the receiver performs the inverse operation of (1), i.e., 
cycle-shift each column i of A by — a m i to obtain user m's decoded 
matrix A m (Fig. 1). The message X m will appear as a complete row in 

Ambiguous decoding occurs when transmissions by other users 
combine to form other complete rows in A m . In a previous analysis of 
the system, 1,2 it was assumed that if there is more than one complete 
row the receiver has no way of finding the correct message and has to 
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Fig. 1 — Transmitted/received matrix A and user m's decoded matrix A m for K = 3 
and L = A. 
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choose one of them at random. We show how further investigation of 
the complete rows can improve the performance. 

III. ADDRESS ASSIGNMENT 

It is convenient to describe the modulation/decoding procedure in 
algebraic terms by denoting the 2 K frequencies as elements of GF(2 K ), 
which is the finite field (Galois field) of 2 K elements 0, 1, • • • , 2 K — 1. 
Such finite fields exist for all Q = p n , where p is a prime and n = 1, 2, 
• • • , and the following analysis and results can be extended to systems 
with Q frequencies. 

Accordingly, the K-bit message X m , the components of a m , Y m , and 
the row numbers in A, A m can all be expressed as elements of GF(2 K ), 
and the operations of addition and multiplication are performed ac- 
cording to the rules of GF(2 K ) (see the appendix). 

Reference 3 describes an optimum structure of addresses which 
guarantees minimum mutual interference between 2 K or fewer users. 
In this scheme, each user is assigned a distinct element of GF{2 K ). Let 
y m denote the element assigned to user m and let /? be a fixed primitive 
element in GF(2 K ). The address of user m is defined to be 

a m = (y m , ynfi, Ym/? 2 , • • • , y^' 1 ). (2) 

Since there are 2 K distinct elements y m , the maximum number of users 
(distinct addresses) is 2 K . Assuming word synchronization (i.e., all 
users start their sequences at the same time slot) it has been shown 
that for L < 2 K — 1 the transmitted sequences of any two users will 
coincide in at most one chip for all possible message values. 

As mentioned before, other modulation schemes are possible (e.g., 
Y m = {y m i) , y m i = X m fl l ~ l + y m ), and the analysis and results that follow 
can be extended to such systems. 

IV. NEW DECODING SCHEME 
4.1 Decoding procedure 

Let M be the number of simultaneous users of the system. Each 
user i transmits a sequence 

Y l = a, + X.l, 

where the address a, is assigned according to (2) and the message value 
is Xi. We assume a synchronous transmission, i.e., all users start their 
sequences at the same time slot. 

In the decoded matrix A m of user m, X m appears as a complete row 
X m -1. Suppose we have another complete row X' in A m which is the 
result of interference. According to the address assignment, each chip 
in X' must come from a different user, so at least L users i\, • • • , II 
have combined to cause this interference. The user that contributes 
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the interference in column n of X' is denoted by i n - (If more than one 
user caused this interference, i„ can be any one of them.) 

From eqs. (1) and (2), the/th entry (j = 1, • • • , L) of user i n in A m 
will be at row c n (j) and column j where 

Cn(j) = y.J J - i +X in -y m p J -\ 

= 8 n p J - l +Xi n , j=l,.-',L, (3) 

y m is the address of the mth user and 

8 n A y.„ - ym. (4) 

Note that 8 n ¥= for all interferers i n , n = 1, • • • , L. 

C n (n) is the row in which the entry of user i n appears at the nth 
column. By definition, this row is X '. So we have the following relation: 

C n (n) = 8 n p n - 1 +X in = X'. (5) 

Let D$ be the matrix obtained by subtracting the number X' from all 
rows of A m (equivalently, shifting row X' in A m to row zero). At Die the 
entry of user i n at column j (j = 1, • • • , L) will be at row d n (j). From 
(3) to (5) we have 

dn(j) = C n (j) -X' 

= M&-* - fi n -\ n,y = l, ...,L. (6) 

Thus by shifting row X' to row zero, the locations of the entries of 
the interferers i u • • • , i L are independent of their message values 
Xi lt • • • , Xi L . 

So if row X' in A m was formed by L interferers with addresses 8 n + 
y m , their entries will appear in D& at rows d n (j) and column j (j,n = 
1, • • • , L). We thus have the following theorem: 

Theorem: A necessary condition for row X' in A m to be caused by 
interference is the existence ofL nonzero numbers 8 n in GF(2 K ) such 
that all entries (d n (j),j){n,j = 1, • • • , L) appear inD%. 

Using (6) we can write for n = 1, • ■ • , L — 1: 

dn(j) = 8 n p n -\F- n - 1), (7) 

d n (n + 1) = Sn/f-'tf - 1). 

Thus we have the following relation: 

d n (n + 1) = fj-nd n (j), (8) 



where 



I^A^L-L 7 = 1,..., L, ;Vn, (9) 
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and all the />■-„ are independent of the particular user and are fixed for 
the system. To check for the existence of user i n {n — 1, • • • , L — 1), we 
multiply all entries (i.e., their row numbers) in column y (j = 1, • • • ,L, 
jf* n,j i* n + 1) ofDIr by fj- n and look for a "complete" row (complete 
except for the nth term). If we find such a row, then a possible 
interferer contributing to column n of X' exists. We see in Section 4.2 
that there is a simple way to realize this procedure. 
To check for user iz,, we modify this procedure and use the formula 

dg.il - 1) = ft-udLU), J = 1, • • • , L - 2, (10) 

where 

fj-LA^fj-L. (ID 

We then multiply all entries in column j {j = 1, • • • , L — 2) byff-L 
and check for a complete row. 

If the condition is satisfied for all n = 1, • • • , L, we assume that row 
X in A m is the result of interference. 

Using this decoding scheme, all interference rows X' will be identified 
as such. The correct row X m will usually fail to satisfy the condition for 
some n and thus will be identified and decoded as the correct message. 

4.2 Realization 

Multiplication of two elements in GF(2 K ) is most easily performed 
by expressing each term as a power of a primitive element /? in the 
field (see the appendix). 

Let Dx' denote the matrix Dfr without row zero. Each row q in Dx- 
can be expressed by its exponent q', that is, 

q = P"\ q,q' = l,-..,2 K -l. (12) 

Since (3 is primitive in GF(2 K ), the transformation q — > qf is a row 
permutation Dx- — > Px- 

Similarly, we can express the multiplication factors ft, ft as powers 
of/?: 

fi = fh, ft = P*. (13) 

Multiplying an element at row q and column j in Dx- by //-„ is 
equivalent to cycle-shifting the corresponding element in Px- (which 
appears at row q' and column j) kj- n positions. 

So to find the existence of a user i„ contributing to column n of X, 
we cycle-shift all entries in column j of Px- (for j = 1, • • • , L, j i* n, 
j ?* ji + 1) kj-n positions and look for a complete row. 

Note that the rule of permutation q — > q' as well as the shifting 
operator k%, i = ± 1, ± 2, • • • , ± (L — 1) are fixed for the system and 
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are independent of the interference pattern. Thus they can be com- 
puted once and stored at the receiver. 

In comparing the complexity of this decoding scheme to complete 
decoding, we have here L + L(L-2) cycle-shifting operations for each 
complete row of A m , while in complete decoding we perform L (2 K - 1) 
cycle-shifting operations. A similar relation holds for the number of 
checking complete rows. So the complexity of the proposed scheme is 
of the order of L 2 compared to an order of L2 K for the complete 
decoding. Since L a K «: 2 K , the new decoding scheme has a much 
smaller complexity than complete decoding, yet it achieves a substan- 
tial improvement in performance. 

V. DECODING ALGORITHM OF USER m 
5. 1 Preliminary computations 

These computations are independent of the received matrix and are 
identical for all users so they can be performed once and stored at the 
receiver. 

(i) Express all nonzero elements q £ GF{2 K ) by their exponents q', 
i.e., q = p*, where (S is the primitive element in GF(2 K ) used to 
generate the addresses. This results in a table of 2 K - 1 pairs {q, q'). 

(ii) Compute 2(L - 1) terms ki, i = ±1, ±2, • • • , ±(L - 1), where 



/?*■ = 



/r-1' 

and generate the cycle-shifting matrix S = {S,-,y} , 



Sij = 



i - 1, • • • , L j=i 

kj-i i = 1, • • • , L — 1 j = 1, • • ■ , L ,^. 

kj-L - 1 i = L j = 1, • • • , L - 1. 



5.2 Computation performed for each code word (L chips) 

(i) From the received matrix A, compute the decoded matrix A m by 
cycle-shifting the columns of A according to the address a m . If A m 
contains only one complete row at X m , it is decoded as the message 
and the procedure terminates. If there are / complete rows (/ > 2), 
X ', • • • , X lI) we check each row X <0 as follows. 

(ii) Subtract (the number of row) X 1 '* from all rows in A m and discard 
row zero to obtain matrix Dx- 

(Hi) Perform row permutation of Dx -> Px according to the table of 
2 K - 1 pairs (q,q'). 

(iv) For each n (n = 1, • • •, L), cycle-shift all columns j in Px 
(jf = l, . . . , L, j ¥> n, n + 1) S n j positions, according to the cycle- 
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shifting matrix S [eq. (14)] and look for a complete row (except the 
term in the nth column). 

If for some n we don't find such a complete row, we decode 

Am = A , 

and the procedure terminates. Otherwise we assume X U) to be the 
result of interference and repeat steps (ii) to (iv) for X il+1) . 

(v) If all rows Xr"(i = 1, •••,!) pass the interference test (this could 
happen, for example, if an interference row coincides with the correct 
message), we cannot determine the correct message and have to pick 
one of the X® at random, as is always done in conventional decoding. 

A flow diagram of the decoding scheme is outlined in Fig. 2. 

The average time needed to decode X m can be reduced by performing 
the interference test in a different order. Instead of checking the 
complete rows sequentially (as described above), we can check the 
first chip of all complete rows, then the second chip, and so on, until 
we find a chip that does not pass the interference test. It can be shown 
that with this scheme the average number of chips checked will be 
smaller and thus the average decoding time will be reduced. 

VI. DECODER IMPLEMENTATION 

The decoder can be implemented either in software or in hardware. 
A software implementation is appropriate for a microprocessor-con- 
trolled receiver and is done according to the flow diagram of Fig. 2. 

Since most decoding operations require shifting [cycle-shifting or 
subtraction in GF(2 K )~\ of columns of various matrices, a simple way 
to implement the decoder in hardware is by using shift registers. 

The decoder is composed of L identical units Ui, • • • , Ul represent- 
ing the L columns of the matrices and a single L-stage shift register 
used to count the number of entries in a row and find the complete 
rows (Fig. 3a). A possible implementation of the basic unit Uj is 
depicted in Fig. 3b. The left shift register system Rfl contains K + 2 
registers of length 1, 1, 1, 1, 4, 8, • • • , 2*" 1 (for a total of 2 K cells) and 
K identical double-pole double-throw switches. When all switches are 
in position 1, cycle-shifting can be performed. To subtract [according 
to the rules of GF(2 K )] a number 2' -1 , each cell in (binary representa- 
tion) position (8k, • • • , 8t, • • • , Si) has to be shifted to position 
(8k, • • • ,8i, ■ ■ • ,8i). For 1 < i < K — 1, this is accomplished by shifting 
the register 2 K steps while changing the position of the switch number 
i every 2' -1 steps (for i = 1, 2 we start at position 1 and for 3 < i < 
K — 1 at position 2). For i = k, the register is cycle-shifted 2 K ~ l steps. 

In general, to subtract a number N = (uk, • • • , /ii), all the switches 
corresponding to the nonzero coefficients of its binary representation 
(except n K ) are operated while the register is shifted 2 K steps. (Switch 
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Fig. 2— Flow diagram of the new decoder. The input is the received matrix A. The 
output is a decoded message value X m . 

lb is used instead of la whenever switch 2 moves to position 2.) If Uk 
= 1, the register is cycle-shifted additional 2 K ~ 1 steps. An example for 
N = 3 and N = 7 is shown in Table I. 

The right shift register Rj 2 contains 2* — 1 cells and performs cycle 
shift operation. The data are fed from the left register system to the 
right register in a parallel-to-parallel mode. Each stage in R j2 is hard- 
wired to a stage in Rj\ according to the row permutation (fixed) rule 
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Fig. 3— Hardware implementation of the decoder, (a) L identical units Uj operate in 
parallel. SR is used to find the complete rows, (b) The basic unit Uj includes two shift 
register systems: Rji can perform subtraction in GF(2 K ) using the switching units sw, 
and R/i perform additional decoding, when necessary, to remove ambiguity. 
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To decode a block, the data are serially fed from the rf detectors to 
the left register systems R fl (j = 1, • • • , L), which are then shifted 
(with switch positions corresponding to the address a m j) to generate 
A m and find its complete rows. To check a complete row, it is shifted 
to row zero and the data are transferred to the right registers R#, 
which are then cycle-shifted according to the shifting matrix S. 

The L-stage shift register sr is parallel-fed from either R/i or R# and 
is used to count the number of entries in a row to find the complete 
rows. 

VII. ERROR PROBABILITIES 

Let the system parameters be K (2 K frequencies), L (sequence 
length), and M (simultaneous users). We assume an algebraic address 
assignment [such as (2)] and a synchronous transmission without 
channel impairments. 

If the decoded matrix A m of user m has only one complete row, this 
row is correctly decoded as the message value X m . If there are two or 
more complete rows in A m , an interference test is performed. An 
interference row will always pass the test since each of its chips is part 
of a sequence transmitted by some user. The correct row will usually 
fail to pass the test for some of its chips and thus can be identified and 
correctly decoded. 

We will have an ambiguity in decoding when the following two 
conditions are satisfied: 

(i) There are two or more complete rows in A m . 
(ii) The correct row passes the interference test. 

When this happens, we choose one complete row at random and 
decode it as the message. 
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Let Pi and P2 be the probabilities of condition (i) and (ii), respec- 
tively. Although not strictly independent, it can be shown using ran- 
dom-coding arguments that the two conditions can be assumed to be 
independent with a negligible effect on the probability of error. Pi can 
be upper bounded 1 by the union bound 

Pi < (2* - l)p L , (15) 

where 

p = 1 - (1 - 2~ K ) M -\ (16) 

Condition (ii) can happen as follows:./ chips in X m (j = 0, 1, . . . , L) are 
also the result of interference (by at least j other users) and the 
remaining L — j chips, although not caused by interference, pass the 
interference test. That is, entries from other users combine to form 
complete rows in the cycle-shifted version ofPx m . 

Let P2J be the probability of condition (ii) when exactly j chips in 
X m come from interference, then 

P2 = £ Fkj. (17) 

y-o 

P2,l corresponds to the case where interference from other users 
combine to form a complete row which coincides with X m . Thus 

P 2 ,l<P l . (18) 

Similarly, 

P 2 ,L-i<Lp L - l (l-p)p, (19) 

where Lp L ~ x (l — p) is the probability that exactly L — 1 chips come 
from interference and p is the probability that a complete row (L — 1 
entries) exists in the cycle-shifted Px m , when checked for the remaining 
chip. Since this complete row could be any of the 2^—1 rows ofPx m , 
we have 

p < (2 K - Dp 1-1 . (20) 

The general term P2J.-J can be upper bounded by 

P2±-j<p L - j (l-p) j ( L \p j . (21) 



Thus 



p* <p L l (f\ [(2* - Da -P)P iL - 2) y, 

P 2 <p L (l + S) L , (22) 



where 



S=(2 K -l)(l-p)p {L - 2) . (23) 
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So, as long as p(l + S) < 1, we can upper-bound the word error 
probability Pe by 

P E < l AP i -P 2 < x h (2 K - 1)(1 + S) V*. (24) 

where the factor of x h comes from the random choice of message when 
the decoding fails. From this we can obtain a bound on the bit error 
probability 1 

p b < 2*- 2 (l + S)V L - (25) 

Comparing the performances to conventional decoding, we see that 
the new decoding scheme has nearly doubled the exponent of p. 

VIII. SYSTEM PERFORMANCE 

The bandwidth necessary to support 2* tones that are orthogonal 
over 7T = T/L seconds is 

W = 2*/t = 2* L/T Hz. 

The transmission rate per user is 

R = K/Tbit/s. 

For a given W, R, and K, the length of the sequence L is determined 
by 

L = rK2~ K , 

where 

r = W/R. 

Let M be the number of users that the system can accommodate at a 
given error probability Pb. The efficiency tj of the system is defined as 

tj = MR/W= (M/r) bit/s/Hz, 

the information rate (bit/s) per unit bandwidth transmitted through 
the system with a bit error probability P b . For a given W, R, and P b , 
there is an optimum K which maximizes the efficiency. 

Figure 4 shows the dependence of M (and tj) on K for P b = 10 -3 and 
r = 626, 320, 165 (corresponding to R = 32 kilobit/second and W a 20, 
10, and 5 MHz, respectively) using the upper bound (25) on P b . 

Since the decoding scheme is based on the address assignment (3) 
which can accommodate at most 2^—1 users, M cannot exceed this 
number. This is shown by the dashed curves. As can be seen, this has 
no influence on the choice of optimum K and the performance at that 
K. 

Figure 5 shows the efficiency of the system as a function of r for 300 
< r < 700, when the optimum K was taken at each r. It can be seen 
that, since K, L, and M assume only integer values, the curve is not 
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Fig. 4 — Number of users M which can simultaneously share the system at an error 
probability of 0.001 as a function of K, for different values of r = W/R. The solid line 
(Af*) is computed using the upper bound (25). The broken line indicates the limit on M 
(2 K ) when the address assignment (2) is used. 



continuous but has local maxima at specific values of r. The same 
phenomenon occurs for conventional decoding. 

To compare the performance of the new decoding scheme with that 
of conventional decoding, consider the case where W = 20.025 MHz, 
R = 32 kilobit/second (r = 625.8), and P b = 10" 3 . (At this r, the 
efficiencies of both schemes have local maxima.) The optimum K is 9 
(corresponding to 512 frequencies) and L = 11 in both schemes. The 
maximum number of users which the system can accommodate is 345 
in the new scheme compared to 216 with conventional decoding. The 
corresponding efficiencies are 55 and 34.5 percent, an improvement of 
almost 60 percent. A similar improvement (of 50 to 60 percent) is 
obtained throughout the range of r. 

Figure 6 depicts the bit error probability as a function of the number 
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of users for both decoding schemes for the above parameters (K = 9, 
L = 11, and r = 625.8). 

While the number of users which the system can actually support 
would be less than illustrated here because of the idealized model used 
in the analysis (as discussed in Ref. 2), the comparative results are 
believed to be valid. 

XI. SUMMARY AND CONCLUSIONS 

A new decoding scheme which makes use of the algebraic structure 
of the addresses to eliminate erroneous messages which come from 
interference was described. Analysis of the noiseless case, where inter- 
ference from other users is the only source of performance impair- 
ments, shows a 50 to 60 percent improvement in efficiency over 
conventional decoding. 

In noisy and multipath fading channels, the received matrix is 
corrupted by insertions and deletions of entries and the correct row 
might be incomplete. In this case, the row with the maximum number 
of entries is decoded as the correct message, and the probability of 
ambiguous reception is increased. For base-to-mobile transmission, the 
conventional decoder has been analyzed 2 in Gaussian noise and a 
multipath fading environment and found to degrade gracefully. Other 
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Fig. 5 — The efficiencies (tj = M/r) for both decoding schemes as a function of r = W/ 
R, when the optimum K is taken at each r. Since K, L, and M assume only integer 
values the curve is not continuous. 
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Fig. 6 — Performance curve as a function of the number of users M for conventional 
and improved decoding. The system parameters are W = 20 MHz, R =» 32 kilobit/ 
second, K = 9, and L — 11. 



factors such as shadow fading, intercell interference (when the system 
is embedded in a matrix of cells covering a large geographic area), and 
synchronization error due to multipath propagation delay spread (most 
relevant to mobile-to-base transmission) are likely to further reduce 
the number of users but as yet have not been analyzed. The new 
decoder is likely to have a similar degradation in typical noisy condi- 
tions encountered in mobile radio and satellite communication sys- 
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terns, but can be expected to yield a substantial improvement over 
conventional decoding. 

APPENDIX 

Algebra of Finite Fields 

A. 1 Rules of addition (subtraction) and multiplication (division) 

Let GF(Q) be a finite field (Galois field) of Q elements 0, 1, 
(Q - 1). Such fields exist for all Q = p", where p is a prime and n = 
1,2,.... 

If Q is a prime (n = 1), the rules of addition and multiplication are 
defined by ordinary modulo Q arithmetics. 

If Q = p n f n = 2, 3, • • • we first represent the elements as p-ary 
vectors of length n (if p = 2, this is the binary representation). Addition 
is now defined as mod p addition of the components. To specify 
multiplication, the zi-tuplets are transformed into polynomials of de- 
gree n - 1 in Z by letting the first digit be the coefficient of Z*" 1 , and 
so on. The multiplication rule is polynomial multiplication (ordinary 
multiplication with mod p addition of coefficients) modulo an irredu- 
cible polynomial of degree n. 

A.2 Multiplication using an exponent representation 

A simple way to perform multiplication in GF(p n ) is: Every nonzero 
element in the field can be expressed as a power of a primitive element 
{} (/? is primitive if the smallest integer k such that /?* = lis& = Q-l). 
Thus if we have a list (table) of all exponent representations, we can 
perform a multiplication of two numbers by adding, modulo (Q - 1), 
their exponents. This is analogous to multiplication of real numbers 
using a table of logarithms. 
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